@foam-ai/node 0.1.0-alpha.4 → 0.1.0-alpha.6

package/dist/init.js

@@ -10,32 +10,73 @@ const resource_js_1 = require("./resource.js");
 const sdk_logs_1 = require("@opentelemetry/sdk-logs");
 const sdk_metrics_1 = require("@opentelemetry/sdk-metrics");
 const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
-const constants_js_1 = require("./constants.js");
-const diagnostics_js_1 = require("./diagnostics.js");
+const report_js_1 = require("./report.js");
 const exporters_js_1 = require("./exporters.js");
 const instrumentations_js_1 = require("./instrumentations.js");
+const before_send_js_1 = require("./before-send.js");
+const logs_js_1 = require("./logs.js");
+const redaction_js_1 = require("./redaction.js");
 const state_js_1 = require("./state.js");
-// TODO(pcga11): redact and beforeSend as well as conflicts handling not yet implemented.
-function init({ sampleRate = 1, disableLogSending = false, networkCapture = "basic", // pcga11: We do not default to advanced because this is something our clients approve to opt in during onboarding.
-enabled = true, ...options }) {
+// TODO(pcga11): conflicts handling pending.
+function init(options) {
+    const { sampleRate = 1, disableLogSending = false, networkCapture = "basic", enabled = true, } = options;
+    const redactionConfig = (0, redaction_js_1.resolveRedactionConfig)(options.redact);
+    const beforeSend = (0, before_send_js_1.resolveBeforeSend)(options.beforeSend);
+    // pcga11: Set params before any early return so every state is reported, including failed or disabled attempts.
+    (0, state_js_1.setParams)({ name: options.name, environment: options.environment });
+    // pcga11: We keep this option because companies often want to turn the integration off in specific envs
     if (!enabled) {
-        (0, diagnostics_js_1.info)("Foam SDK for Node.js is disabled");
+        (0, report_js_1.report)({
+            token: options.token,
+            severity: api_logs_1.SeverityNumber.INFO,
+            message: 'SDK disabled',
+        });
         return;
     }
+    if (!options.token) {
+        // pcga11: Nothing can be sent without a token; report() still logs locally so this is not silent.
+        (0, report_js_1.report)({
+            severity: api_logs_1.SeverityNumber.ERROR,
+            message: 'Parameter token not provided',
+        });
+        return;
+    }
+    // pcga11: Re-initializing could register duplicate providers/instrumentations, so we track the initialization state and bail out on repeat calls
     if ((0, state_js_1.getInitialized)()) {
-        (0, diagnostics_js_1.warn)("Foam SDK for Node.js is already initialized");
+        (0, report_js_1.report)({
+            token: options.token,
+            severity: api_logs_1.SeverityNumber.WARN,
+            message: 'SDK already initialized',
+        });
         return;
     }
-    (0, diagnostics_js_1.configureDiagnostics)();
-    if (!options.name?.trim() || !options.environment?.trim() || !options.token) {
-        (0, diagnostics_js_1.error)(`${constants_js_1.FOAM_IDENTIFIER_NAME}: name, environment, and token are required`);
+    if (!options.name?.trim() || !options.environment?.trim()) {
+        (0, report_js_1.report)({
+            token: options.token,
+            severity: api_logs_1.SeverityNumber.ERROR,
+            message: 'Parameters name and environment not provided',
+        });
+        return;
+    }
+    if (!Number.isFinite(sampleRate) || sampleRate < 0 || sampleRate > 1) {
+        (0, report_js_1.report)({
+            token: options.token,
+            severity: api_logs_1.SeverityNumber.ERROR,
+            message: 'Parameter sampleRate must be a finite number between 0 and 1',
+        });
         return;
     }
+    // pcga11: Hoisted so the catch block can shut down providers whose batch/periodic
+    // export timers started in their constructors, even when init fails midway.
+    let tracerProvider;
+    let meterProvider;
     try {
+        (0, redaction_js_1.setActiveRedactionConfig)(redactionConfig);
         const resource = (0, resource_js_1.createFoamResource)(options.name, options.environment, options.version, options.additionalResourceAttributes);
-        // pcga11: Register our context manager and propagator; if another SDK already
-        // registered one, keep theirs
-        // TODO(pcga11): Implement a way to handle piggy backing the context manager and propagator from another SDK.
+        // pcga11: The context manager is what makes the "current" context (active span, baggage)
+        // follow execution across await/callback boundaries, via Node's AsyncLocalStorage. Without
+        // one registered, spans would not nest and trace/log correlation would break. Registration
+        // is first-wins: if another SDK already installed one, we keep theirs and disable ours.
         const contextManager = new context_async_hooks_1.AsyncLocalStorageContextManager();
         contextManager.enable();
         if (!api_1.context.setGlobalContextManager(contextManager)) {
@@ -46,20 +87,23 @@ enabled = true, ...options }) {
                 new core_1.W3CTraceContextPropagator(),
                 new core_1.W3CBaggagePropagator(),
             ],
-        })));
+        })) ? state_js_1.SignalSources.global : state_js_1.SignalSources.none);
         // pcga11: The @opentelemetry/api setters return false when another SDK already owns a slot (registration is first-wins). So we try to register our own and if it fails or already taken, nothing happens.
         // TODO(pcga11): Implement a way to handle piggy backing the context and propagation from another SDK.
-        const tracerProvider = new sdk_trace_base_1.BasicTracerProvider({
+        tracerProvider = new sdk_trace_base_1.BasicTracerProvider({
             resource,
             sampler: new sdk_trace_base_1.ParentBasedSampler({
                 root: new sdk_trace_base_1.TraceIdRatioBasedSampler(sampleRate),
             }),
             spanProcessors: [
-                new sdk_trace_base_1.BatchSpanProcessor(new exporters_js_1.FoamTraceExporter(options.token)),
+                new sdk_trace_base_1.BatchSpanProcessor(new exporters_js_1.FoamTraceExporter(options.token, undefined, {
+                    redaction: redactionConfig,
+                    beforeSend,
+                })),
                 ...(options.additionalSpanProcessors ?? []),
             ],
         });
-        const meterProvider = new sdk_metrics_1.MeterProvider({
+        meterProvider = new sdk_metrics_1.MeterProvider({
             resource,
             readers: [
                 new sdk_metrics_1.PeriodicExportingMetricReader({
@@ -72,49 +116,53 @@ enabled = true, ...options }) {
             resource,
             processors: [
                 new sdk_logs_1.BatchLogRecordProcessor({
-                    exporter: new exporters_js_1.FoamLogExporter(options.token),
+                    exporter: new exporters_js_1.FoamLogExporter(options.token, undefined, {
+                        redaction: redactionConfig,
+                        beforeSend,
+                    }),
                 }),
                 ...(options.additionalLogRecordProcessors ?? []),
             ],
         });
-        // pcga11: trace/metrics/propagation setters return false when the slot is taken by another SDK. The logs setter returns whichever provider ended up registered. We use that to mark ownership.
-        (0, state_js_1.setSignal)(state_js_1.Signals.traces, api_1.trace.setGlobalTracerProvider(tracerProvider));
-        (0, state_js_1.setSignal)(state_js_1.Signals.metrics, api_1.metrics.setGlobalMeterProvider(meterProvider));
-        (0, state_js_1.setSignal)(state_js_1.Signals.logs, api_logs_1.logs.setGlobalLoggerProvider(loggerProvider) === loggerProvider);
+        (0, logs_js_1.setFoamLoggerProvider)(loggerProvider);
+        // pcga11: trace/metrics/propagation setters return false when the slot is taken by another SDK. The logs setter returns whichever provider ended up registered. We use that to record the source: "global" when Foam owns the slot, "none" when another SDK does. Logs fall back to "local" because the Foam-only provider behind log() exists either way.
+        (0, state_js_1.setSignal)(state_js_1.Signals.traces, api_1.trace.setGlobalTracerProvider(tracerProvider) ? state_js_1.SignalSources.global : state_js_1.SignalSources.none);
+        (0, state_js_1.setSignal)(state_js_1.Signals.metrics, api_1.metrics.setGlobalMeterProvider(meterProvider) ? state_js_1.SignalSources.global : state_js_1.SignalSources.none);
+        (0, state_js_1.setSignal)(state_js_1.Signals.logs, api_logs_1.logs.setGlobalLoggerProvider(loggerProvider) === loggerProvider ? state_js_1.SignalSources.global : state_js_1.SignalSources.local);
         const instrumentations = (0, instrumentations_js_1.buildInstrumentations)(networkCapture, disableLogSending, options.ignoredOutboundHosts, options.additionalInstrumentations ?? []);
+        // pcga11: registerInstrumentations turns on instrumentation "hooks". OpenTelemetry wraps supported libraries when the app imports them.
         (0, instrumentation_1.registerInstrumentations)({ instrumentations });
         (0, state_js_1.setInstrumentations)(instrumentations.map(instrumentations_js_1.instrumentationName));
-        // pcga11: Signals are flushed, remaining batches are sent, and exporters are stopped before the process exits.
         process.once("beforeExit", () => {
             void Promise.all([
-                (0, state_js_1.getSignal)(state_js_1.Signals.traces) ? tracerProvider.shutdown() : undefined,
-                (0, state_js_1.getSignal)(state_js_1.Signals.metrics) ? meterProvider.shutdown() : undefined,
-                (0, state_js_1.getSignal)(state_js_1.Signals.logs) ? loggerProvider.shutdown() : undefined,
+                (0, state_js_1.getSignal)(state_js_1.Signals.traces) === state_js_1.SignalSources.global ? tracerProvider?.shutdown() : undefined,
+                (0, state_js_1.getSignal)(state_js_1.Signals.metrics) === state_js_1.SignalSources.global ? meterProvider?.shutdown() : undefined,
+                loggerProvider.shutdown(),
             ]).catch(() => undefined);
         });
         (0, state_js_1.setInitialized)(true);
-        (0, diagnostics_js_1.info)("Foam SDK for Node.js initialized");
-        void (0, diagnostics_js_1.sendStateDiagnosticLog)({
-            name: options.name,
-            environment: options.environment,
+        (0, report_js_1.report)({
             token: options.token,
-            tier: "internal",
             severity: api_logs_1.SeverityNumber.INFO,
+            message: 'SDK initialized',
         });
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
         for (const signal of [state_js_1.Signals.traces, state_js_1.Signals.metrics, state_js_1.Signals.logs, state_js_1.Signals.baggage]) {
-            (0, state_js_1.setSignal)(signal, false);
+            (0, state_js_1.setSignal)(signal, state_js_1.SignalSources.none);
         }
+        void Promise.all([
+            tracerProvider?.shutdown(),
+            meterProvider?.shutdown(),
+            (0, logs_js_1.getFoamLoggerProvider)()?.shutdown(),
+        ]).catch(() => undefined);
+        (0, logs_js_1.clearFoamLoggerProvider)();
         (0, state_js_1.setInitialized)(false);
-        (0, diagnostics_js_1.error)(`Foam SDK for Node.js initialization failed: ${errorMessage}`);
-        void (0, diagnostics_js_1.sendStateDiagnosticLog)({
-            name: options.name,
-            environment: options.environment,
+        (0, report_js_1.report)({
             token: options.token,
-            tier: "internal",
             severity: api_logs_1.SeverityNumber.ERROR,
+            message: `SDK initialization failed: ${errorMessage}`,
             error: errorMessage,
         });
     }

package/dist/instrumentations.js

@@ -5,11 +5,33 @@ exports.buildInstrumentations = buildInstrumentations;
 const auto_instrumentations_node_1 = require("@opentelemetry/auto-instrumentations-node");
 const instrumentation_console_1 = require("@opentelemetry/instrumentation-console");
 const index_js_1 = require("./network-capture/index.js");
+const endpoint_js_1 = require("./endpoint.js");
 const state_js_1 = require("./state.js");
 const constants_js_1 = require("./constants.js");
 function buildInstrumentations(networkCapture = "basic", disableLogSending = false, ignoredOutboundHosts, additionalInstrumentations) {
-    const bodyCaptureEnabled = (0, state_js_1.getSignal)(state_js_1.Signals.logs);
+    // pcga11: Captured bodies are emitted through the global logs pipeline. Only enable
+    // capture when that pipeline delivers to Foam ("global"/"ingest").
+    // If another SDK owns the slot (aka we have "local" for logs), capturing would be done for other vendors instead of Foam which might be non-compliant.
+    // If it's "none", capturing does not work at all.
+    const logsSource = (0, state_js_1.getSignal)(state_js_1.Signals.logs);
+    const bodyCaptureEnabled = logsSource === state_js_1.SignalSources.global || logsSource === state_js_1.SignalSources.ingest;
     const capturedHeaders = networkCapture === "off" ? undefined : [...constants_js_1.SAFE_NETWORK_HEADERS];
+    // pcga11: Skip Foam's OTLP export HTTP calls so they do not become client spans
+    // TODO(pcga11): This could get real interesting: could we use these calls to verify coverage? IDK maybe tarpid
+    const ignoredHosts = new Set([
+        new URL(endpoint_js_1.endpoint).hostname,
+        ...(ignoredOutboundHosts ?? []),
+    ]);
+    const ignoreHttpOutgoingRequest = ((request) => typeof request.hostname === "string" &&
+        ignoredHosts.has(request.hostname));
+    const ignoreUndiciRequest = ((request) => {
+        try {
+            return ignoredHosts.has(new URL(request.origin).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
     const bodyHooks = networkCapture === "advanced"
         ? (0, index_js_1.createNetworkCaptureHooks)(bodyCaptureEnabled)
         : undefined;
@@ -36,8 +58,7 @@ function buildInstrumentations(networkCapture = "basic", disableLogSending = fal
                 }
                 : {}),
             ...(bodyHooks ?? {}),
-            ignoreOutgoingRequestHook: ((request) => typeof request.hostname === "string" &&
-                (ignoredOutboundHosts ?? []).includes(request.hostname)),
+            ignoreOutgoingRequestHook: ignoreHttpOutgoingRequest,
         },
         "@opentelemetry/instrumentation-openai": {
             captureMessageContent: networkCapture === "advanced",
@@ -55,6 +76,7 @@ function buildInstrumentations(networkCapture = "basic", disableLogSending = fal
                 }
                 : {}),
             ...(advancedUndiciHooks ?? {}),
+            ignoreRequestHook: ignoreUndiciRequest,
         },
         "@opentelemetry/instrumentation-winston": {
             disableLogSending: disableLogSending === true,

package/dist/logs.d.ts

@@ -0,0 +1,10 @@
+import type { Attributes } from "@opentelemetry/api";
+import { SeverityNumber } from "@opentelemetry/api-logs";
+import { LoggerProvider } from "@opentelemetry/sdk-logs";
+import { type FoamExporterOptions } from "./exporters.js";
+export declare function setFoamLoggerProvider(provider: LoggerProvider): void;
+export declare function getFoamLoggerProvider(): LoggerProvider | undefined;
+export declare function clearFoamLoggerProvider(): void;
+export declare function ensureFoamLoggerProvider(name: string, environment: string, token: string, stamp?: Attributes, options?: FoamExporterOptions): LoggerProvider;
+export declare const log: (body: string, severityNumber?: SeverityNumber, attributes?: Attributes) => void;
+export { SeverityNumber };

package/dist/logs.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SeverityNumber = exports.log = void 0;
+exports.setFoamLoggerProvider = setFoamLoggerProvider;
+exports.getFoamLoggerProvider = getFoamLoggerProvider;
+exports.clearFoamLoggerProvider = clearFoamLoggerProvider;
+exports.ensureFoamLoggerProvider = ensureFoamLoggerProvider;
+const api_logs_1 = require("@opentelemetry/api-logs");
+Object.defineProperty(exports, "SeverityNumber", { enumerable: true, get: function () { return api_logs_1.SeverityNumber; } });
+const sdk_logs_1 = require("@opentelemetry/sdk-logs");
+const constants_js_1 = require("./constants.js");
+const exporters_js_1 = require("./exporters.js");
+const resource_js_1 = require("./resource.js");
+const utils_js_1 = require("./utils.js");
+let foamLoggerProvider;
+function setFoamLoggerProvider(provider) {
+    if (foamLoggerProvider && foamLoggerProvider !== provider) {
+        void foamLoggerProvider.shutdown().catch(() => undefined);
+    }
+    foamLoggerProvider = provider;
+}
+function getFoamLoggerProvider() {
+    return foamLoggerProvider;
+}
+function clearFoamLoggerProvider() {
+    foamLoggerProvider = undefined;
+}
+function ensureFoamLoggerProvider(name, environment, token, stamp, options) {
+    const existing = foamLoggerProvider;
+    if (existing) {
+        return existing;
+    }
+    const provider = new sdk_logs_1.LoggerProvider({
+        resource: (0, resource_js_1.createFoamResource)(name, environment),
+        processors: [
+            new sdk_logs_1.BatchLogRecordProcessor({
+                exporter: new exporters_js_1.FoamLogExporter(token, stamp, options),
+            }),
+        ],
+    });
+    setFoamLoggerProvider(provider);
+    process.once("beforeExit", () => {
+        void provider.shutdown().catch(() => undefined);
+    });
+    return provider;
+}
+const log = (body, severityNumber = api_logs_1.SeverityNumber.INFO, attributes) => {
+    const provider = foamLoggerProvider;
+    if (!provider) {
+        return;
+    }
+    (0, utils_js_1.safely)(() => {
+        provider.getLogger(constants_js_1.FOAM_DISTRO_NAME, constants_js_1.FOAM_DISTRO_VERSION).emit({
+            body,
+            severityNumber,
+            severityText: constants_js_1.SEVERITY_TEXT[severityNumber],
+            attributes,
+        });
+    });
+};
+exports.log = log;

package/dist/network-capture/collector.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BodyCollector = void 0;
 exports.setHeaderAttributes = setHeaderAttributes;
@@ -6,9 +39,10 @@ const api_1 = require("@opentelemetry/api");
 const api_logs_1 = require("@opentelemetry/api-logs");
 const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
 const node_crypto_1 = require("node:crypto");
-const node_zlib_1 = require("node:zlib");
+const zlib = __importStar(require("node:zlib"));
 const constants_js_1 = require("../constants.js");
 const utils_js_1 = require("../utils.js");
+const redact_js_1 = require("./redact.js");
 const ALLOWED_HEADERS = new Set(constants_js_1.SAFE_NETWORK_HEADERS);
 const ATTR = {
     request: {
@@ -48,12 +82,14 @@ function setHeaderAttributes(span, direction, headers) {
     if (Object.keys(attributes).length > 0)
         span.setAttributes(attributes);
 }
+function stringEncoding(encoding) {
+    return typeof encoding === "string" && Buffer.isEncoding(encoding)
+        ? encoding
+        : "utf8";
+}
 function copyBody(value, encoding) {
     if (typeof value === "string") {
-        const enc = typeof encoding === "string" && Buffer.isEncoding(encoding)
-            ? encoding
-            : "utf8";
-        return Buffer.from(value, enc);
+        return Buffer.from(value, stringEncoding(encoding));
     }
     if (Buffer.isBuffer(value))
         return Buffer.from(value);
@@ -62,30 +98,58 @@ function copyBody(value, encoding) {
     }
     return undefined;
 }
+// Byte length of a body chunk without copying it; undefined for non-body values.
+function bodyByteLength(value, encoding) {
+    if (typeof value === "string") {
+        return Buffer.byteLength(value, stringEncoding(encoding));
+    }
+    if (Buffer.isBuffer(value) || ArrayBuffer.isView(value)) {
+        return value.byteLength;
+    }
+    return undefined;
+}
 function decodeBody(bytes, contentEncoding) {
     if (contentEncoding === undefined)
         return bytes;
-    const encoding = headerValues(contentEncoding)[0]?.toLowerCase().trim();
-    if (!encoding || encoding === "identity")
+    const encodings = headerValues(contentEncoding)
+        .flatMap((value) => value.split(","))
+        .map((value) => value.trim().toLowerCase())
+        .filter((value) => value && value !== "identity");
+    if (encodings.length === 0)
         return bytes;
+    const limits = { maxOutputLength: constants_js_1.NETWORK_BODY_MAX_DECODE_BYTES };
+    let decoded = bytes;
     try {
-        if (encoding === "gzip" || encoding === "x-gzip")
-            return (0, node_zlib_1.gunzipSync)(bytes);
-        if (encoding === "deflate") {
-            try {
-                return (0, node_zlib_1.inflateSync)(bytes);
+        for (const encoding of encodings.reverse()) {
+            if (encoding === "gzip" || encoding === "x-gzip") {
+                decoded = zlib.gunzipSync(decoded, limits);
             }
-            catch {
-                return (0, node_zlib_1.unzipSync)(bytes);
+            else if (encoding === "deflate") {
+                try {
+                    decoded = zlib.inflateSync(decoded, limits);
+                }
+                catch {
+                    decoded = zlib.unzipSync(decoded, limits);
+                }
+            }
+            else if (encoding === "br") {
+                decoded = zlib.brotliDecompressSync(decoded, limits);
+            }
+            else if (encoding === "zstd") {
+                const decompress = zlib.zstdDecompressSync;
+                if (!decompress)
+                    return undefined;
+                decoded = decompress(decoded, limits);
+            }
+            else {
+                return undefined;
             }
         }
-        if (encoding === "br")
-            return (0, node_zlib_1.brotliDecompressSync)(bytes);
+        return decoded;
     }
     catch {
         return undefined;
     }
-    return undefined;
 }
 function textEncoding(contentType) {
     const raw = headerValues(contentType)[0];
@@ -96,21 +160,21 @@ function textEncoding(contentType) {
     const charset = parts
         .find((part) => part.toLowerCase().startsWith("charset="))
         ?.slice("charset=".length)
+        .trim()
+        .replace(/^["']|["']$/g, "")
         .toLowerCase();
-    const text = media.startsWith("text/") ||
-        media.endsWith("/json") ||
-        media.endsWith("+json") ||
-        media.endsWith("/xml") ||
-        media.endsWith("+xml") ||
-        media.endsWith("/yaml") ||
-        media.endsWith("+yaml") ||
-        media === "application/x-www-form-urlencoded" ||
-        Boolean(charset);
-    if (!text)
+    const isText = (0, redact_js_1.isTextualBodyMediaType)(media) || Boolean(charset);
+    if (!isText)
         return undefined;
-    return charset && Buffer.isEncoding(charset) ? charset : "utf8";
+    if (charset && Buffer.isEncoding(charset))
+        return charset;
+    if (charset === "iso-8859-1" || charset === "windows-1252")
+        return "latin1";
+    if (media.startsWith("multipart/"))
+        return "latin1";
+    return "utf8";
 }
-/** Last index such that `buf.subarray(0, end)` is complete UTF-8, capped at `max`. */
+// Last index such that `buf.subarray(0, end)` is complete UTF-8, capped at `max`.
 function utf8End(buf, max) {
     const end = Math.min(max, buf.byteLength);
     if (end === 0)
@@ -132,20 +196,17 @@ function utf8End(buf, max) {
                     : Number.POSITIVE_INFINITY;
     return end - (leadAt - 1) >= needed ? end : leadAt - 1;
 }
-// pcga11: Span attributes cannot carry byte arrays (OTel AttributeValue).
-// Text goes on the span; binary uses the same `http.*.body.content` name on
-// the correlated event, where log attributes accept Uint8Array.
-function spanBodyContent(decoded, contentType) {
-    const encoding = textEncoding(contentType);
-    if (encoding === undefined)
-        return undefined;
-    const limited = decoded.byteLength > constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES
-        ? decoded.subarray(0, constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES)
-        : decoded;
-    const end = encoding === "utf8" || encoding === "utf-8"
-        ? utf8End(limited, limited.byteLength)
-        : limited.byteLength;
-    return limited.subarray(0, end).toString(encoding);
+function cappedBody(buf) {
+    if (buf.byteLength <= constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES)
+        return buf;
+    return buf.subarray(0, constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES);
+}
+function decodeText(decoded, encoding) {
+    const limited = cappedBody(decoded);
+    if (encoding === "utf8" || encoding === "utf-8") {
+        return limited.subarray(0, utf8End(limited, limited.byteLength)).toString(encoding);
+    }
+    return limited.toString(encoding);
 }
 class BodyCollector {
     span;
@@ -195,17 +256,28 @@ class BodyCollector {
     observe(value, encoding) {
         if (this.finalized)
             return;
+        if (this.capturedBytes >= constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES) {
+            // Past the cap every chunk is discarded; only its length is needed
+            // (for the observed size), so skip the per-chunk copy that would
+            // otherwise double the allocation traffic of large transfers.
+            const length = bodyByteLength(value, encoding);
+            if (length === undefined)
+                return;
+            this.deadline.refresh();
+            this.observedBytes += length;
+            this.truncated = true;
+            this.span.setAttributes({
+                [this.attr.size]: this.observedBytes,
+                [this.attr.truncated]: true,
+            });
+            return;
+        }
         const bytes = copyBody(value, encoding);
         if (!bytes)
             return;
         this.deadline.refresh();
         this.observedBytes += bytes.byteLength;
         this.span.setAttribute(this.attr.size, this.observedBytes);
-        if (this.capturedBytes >= constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES) {
-            this.truncated = true;
-            this.span.setAttribute(this.attr.truncated, true);
-            return;
-        }
         const room = constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES - this.capturedBytes;
         const kept = bytes.byteLength > room ? bytes.subarray(0, room) : bytes;
         this.chunks.push(kept);
@@ -236,35 +308,54 @@ class BodyCollector {
         });
     }
     emit(buffers, headers, complete) {
-        const outcome = this.observedBytes === 0
-            ? "empty"
-            : complete
-                ? "captured"
-                : "incomplete";
+        let outcome;
+        if (this.observedBytes === 0)
+            outcome = "empty";
+        else if (complete)
+            outcome = "captured";
+        else
+            outcome = "incomplete";
         if (outcome === "empty")
             return;
-        const wire = buffers.length <= 1 ? buffers[0] : Buffer.concat(buffers);
+        let wire;
+        if (buffers.length === 0)
+            wire = undefined;
+        else if (buffers.length === 1)
+            wire = buffers[0];
+        else
+            wire = Buffer.concat(buffers);
+        // Span attributes cannot hold bytes (OTel AttributeValue). Text goes on
+        // the span; binary uses the same `http.*.body.content` name on the event.
         let binaryContent;
-        if (wire) {
+        let chunkSource = wire;
+        let chunkSourceIsDecodedText = false;
+        if (wire !== undefined) {
             const decoded = decodeBody(wire, headers["content-encoding"]);
-            const source = decoded ?? wire;
-            const text = decoded
-                ? spanBodyContent(decoded, headers["content-type"])
-                : undefined;
-            if (text !== undefined) {
-                this.span.setAttribute(this.attr.content, text);
+            if (decoded === undefined) {
+                binaryContent = Uint8Array.from(cappedBody(wire));
             }
             else {
-                const limited = source.byteLength > constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES
-                    ? source.subarray(0, constants_js_1.NETWORK_BODY_MAX_CAPTURE_BYTES)
-                    : source;
-                binaryContent = Uint8Array.from(limited);
+                const encoding = textEncoding(headers["content-type"]);
+                if (encoding !== undefined) {
+                    const redacted = (0, redact_js_1.redactBodyText)(decodeText(decoded, encoding), headers["content-type"]);
+                    this.span.setAttribute(this.attr.content, redacted.text);
+                    if (redacted.changed) {
+                        // pcga11: Chunk events must not re-ship bytes the span content
+                        // redacted, so the (possibly compressed) wire bytes are replaced
+                        // with the redacted text.
+                        chunkSource = Buffer.from(redacted.text, encoding);
+                        chunkSourceIsDecodedText = true;
+                    }
+                }
+                else {
+                    binaryContent = Uint8Array.from(cappedBody(decoded));
+                }
             }
         }
         const chunks = [];
-        if (wire) {
-            for (let i = 0; i < wire.byteLength; i += constants_js_1.NETWORK_BODY_CHUNK_BYTES) {
-                chunks.push(wire.subarray(i, i + constants_js_1.NETWORK_BODY_CHUNK_BYTES));
+        if (chunkSource) {
+            for (let i = 0; i < chunkSource.byteLength; i += constants_js_1.NETWORK_BODY_CHUNK_BYTES) {
+                chunks.push(chunkSource.subarray(i, i + constants_js_1.NETWORK_BODY_CHUNK_BYTES));
             }
         }
         const common = {
@@ -275,10 +366,18 @@ class BodyCollector {
             [constants_js_1.ATTR_FOAM_HTTP_BODY_TRUNCATED]: this.truncated,
             [constants_js_1.ATTR_FOAM_HTTP_BODY_OUTCOME]: outcome,
             [this.attr.size]: this.observedBytes,
-            [constants_js_1.ATTR_FOAM_HTTP_BODY_CAPTURED_BYTES]: this.capturedBytes,
+            [constants_js_1.ATTR_FOAM_HTTP_BODY_CAPTURED_BYTES]: chunkSourceIsDecodedText
+                ? (chunkSource?.byteLength ?? 0)
+                : this.capturedBytes,
             [constants_js_1.ATTR_FOAM_HTTP_BODY_CHUNK_COUNT]: chunks.length,
         };
         for (const name of ["content-type", "content-encoding"]) {
+            if (name === "content-encoding" &&
+                chunkSourceIsDecodedText &&
+                headers[name] !== undefined) {
+                common[this.attr.header(name)] = ["identity"];
+                continue;
+            }
             if (headers[name] !== undefined) {
                 common[this.attr.header(name)] = headerValues(headers[name]);
             }

package/dist/network-capture/http.d.ts

@@ -1,5 +1,4 @@
 import type { HttpRequestCustomAttributeFunction, HttpResponseCustomAttributeFunction } from "@opentelemetry/instrumentation-http";
-/** Builds OTel HTTP request/response hooks that record headers as span attributes and stream bodies as log events. */
 export declare function createNetworkCaptureHooks(bodyCaptureEnabled?: boolean): {
     requestHook: HttpRequestCustomAttributeFunction;
     responseHook: HttpResponseCustomAttributeFunction;